MGS9019: invalid token record skipped
A file in $XDG_STATE_HOME/magus/tokens.d holds a record that
magus config ... create could never have written. The store skips that one
file: it verifies nothing, lists nowhere, and every other token keeps working.
magus doctor fails its tokens check naming the file, and the server logs it
once.
[MGS9019] auth: token record /path/tokens.d/laptop.json is skipped: tokens=write
is the operator's alone; remove it (`rm /path/tokens.d/laptop.json`) and mint
its replacement
see: .../MGS9019.md
Why
A record is held at load to every rule a mint is held to, so a file planted in
tokens.d, by hand or by any process that can write there, cannot grant more
than one minted there. The rules:
- a stored token never holds
tokens=write, which is the operator's alone, and grants something the grant model knows; - it expires, after it was created, at most 366 days later (a link's one-time code: at most a minute);
- it was not created in the future;
- its name is the file's name, is a valid name, and does not look like an id;
- its id is the first 8 hex of a well-formed SHA-256.
The guard is a seatbelt here, not a boundary: a process running as you can write the file whatever magus says. What magus enforces is that the file cannot escalate once written.
Resolution
Remove the file the message names and mint what it should have been:
rm <file>
magus config console token create --name <name> # a browser
magus config mcp connector create --name <name> # an MCP client
If you did not put the file there, treat the machine as untrusted until you know what did.